2

Given 3 ethernet interfaces, I'd like to accomplish this:

eth0 -> WAN
eth1 -> EAPoL authenticator
eth2 -> IP Nat to private network

In this scenario, I would like ebtables to filter and forward ethernet frames of type 0x888E (EAPoL) to/from the WAN through eth1 which will have the EAPoL authenticator connected. The remaining traffic I would like to IP NAT to eth2.

I was reading about brouting here:

http://ebtables.netfilter.org/examples/basic.html#ex_brouter

Though it's not clear how I use the above for layer 2 filtering.

Instead, what i've tried so far was to create a bridge with eth0 and eth1 and then an ebtables filtering rule so that only EAPoL traffic arrives on eth1:

ebtables -t filter -A FORWARD -i eth0 -p 0x888e -j ACCEPT
ebtables -t filter -A FORWARD -i eth0 -j DROP
ebtables -t filter -A FORWARD -o eth0 -p 0x888e -j ACCEPT
ebtables -t filter -A FORWARD -o eth0 -j DROP

Then I IP NAT between eth0 and eth2:

iptables -t nat -A POSTROUTING -o eth0-j MASQUERADE
iptables -A FORWARD -i eth2 -j ACCEPT

unfortunately, I can't get BOTH of these to work at the same time, only one or the other.

Any ideas? Appreciate any thoughts or tips

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.